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Identifying lens spaces using discrete logarithms 


Greg Kuperberg* 

University of California, Davis 

We show that if a closed, oriented 3-manifold M is secretly homeomorphic to a lens space L{n, k), then we can 
compute n and k in randomized polynomial time (in the size of the triangulation of M) with a discrete logarithm 
oracle. Using Shor’s algorithm, a quantum computer can thus identify lens spaces in quantum polynomial time. 
In addition, k can be computed in functional NP. A given value of k can be certified in randomized polynomial 
time, specifically in coRP. The idea of the algorithm is to calculate Reidemeister torsion over a prime field that 
has nth roots of unity. 


1. INTRODUCTION 

The algorithmic problem of distinguishing or classifying 
closed r/-dimensional manifolds is elementary when d <2, 
provably impossible when d >4, and recursive when d = 3 
[11]. The remaining question is how efficiently we can distin¬ 
guish closed 3-manifolds; or whether we can distinguish them 
efficiently with one or another form of help. One small but 
interesting part of this question is the case of lens spaces. If 
M is a closed, oriented 3-manifold, conventionally given by 
a triangulation, then is it a lens space? If so, which one? In 
this article, we will only address the second question, with the 
following main result. 

Theorem 1.1. Suppose that M is a closed, oriented 3- 
manifold given by a triangulation with t tetrahedra, and that 
secretly M = L{n,k). Then n and k can be computed in poly¬ 
nomial time (in t), with the help of an oracle that can compute 
discrete logarithms in rings of the form 'LlL 

Recall that each lens space is denoted L{n,k), and is con¬ 
structed by gluing the top hemisphere of a ball (often imag¬ 
ined as a convex dihedron, a “lens”) to the bottom hemisphere 
with a rotation of Inkln. (It is standard to write L{p,q), but 
we will write L{n,k) due to the convention in number the¬ 
ory that p denotes a prime number.) The first parameter n 
is no secret, because if M = L{n,k), then we can calculate 
Hi{M) = Lln in polynomial time. (The fundamental group 
TTi (M) is also cyclic of order n, but it is less computationally 
accessible in 3 dimensions; and not at all in higher dimen¬ 
sions.) The second parameter k is more subtle. We can take it 
to be a prime residue k € {Ljn)^. Reidemeister [17] showed 
that 

L(n,k\) =L(n,k 2 ) 

as oriented 3-manifolds if and only if ki = k 2 or k\ = \ /k 2 . 

In another respect, both parameters are more subtle than 
one might expect. Suppose that M = L{n,k) has t tetrahedra. 
In the most standard (generalized) triangulation of L{n,k), n = 
t. But there are other families of triangulated manifolds M = 
L{n,k) such that n is exponential in t, and with exponentially 
many values of k for specific values of n. See Section 3. 


* greg@math.ucdavis.edu; Partly supported by NSF grant CCF-1319245 


One inspiration for our result is a recent result announced 
by Lackenby and Schleimer [ 1 3] to both recognize whether M 
is a lens space, and if so which one, in the complexity class 
FNP. (See Section 2 for definitions.) In other words, they 
provide a deterministic algorithm (a verifier) with the help of 
a prover who asserts the answer and provides a certificate that 
it is correct. They have no certificate when M is not a lens 
space; but there is another NP certificate for this case [9], us¬ 
ing the geometrization theorem and assuming the generalized 
Riemann hypothesis (GRH). 

Note that it is easier to answer whether M = L{n,k) for any 
fixed value of n, or when n is written in unary. (So that n 
rather than logn is polynomially bounded.) In this case, we 

_ ? 

can construct the u-fold cover M, and answer M = using 
the earlier result of Schleimer [20] that 3-sphere recognition 
is in NP. (It is also in coNP, assuming GRH [9]). We can 
then compute the Reidemeister torsion of M and calculate k 
in polynomial time, without discrete logarithms. However, 
the standard calculation of Reidemeister torsion uses the ring 
or its fraction field Q(C;i). where is an nth root of 
unity. This is comparable to computing homology in M, and 
is thus a slow algorithm when n is not controlled. 

The idea of our algorithm to prove Theorem 1.1 is simple: 
We instead compute Reidemeister torsion in a prime field L/i 
with i= \ (mod u). It turns out that we need discrete loga¬ 
rithms, but no other artificial help, to interpret the answer. We 
also need to factor n\ we can do this using discrete logarithms 
in Ljn [4]. 

Our algorithm for Theorem 1.1 has other uses that we sum¬ 
marize in a separate theorem. 

Theorem 1.2. If M ^ L{n,k) is a closed, oriented, triangu¬ 
lated 3-manifold with k secret, then k can be computed in 
functional BQP and in FNP. If k is provided, then it can be 
confirmed in coRP. If the prime factorization ofn is also pro¬ 
vided, then k can be confirmed in ZPP. If the largest prime 
factor of n is polynomially bounded, then k can be computed 
in functional ZPP. 

See Section 2 for the definitions of complexity classes used 
in Theorem 1.2 and in this introduction in general. The gist 
is that ZPP and coRP are two standards of randomized, poly¬ 
nomial time computation. In coRP, an answer of “no” is cer¬ 
tain, while an answer of “yes” is only probably correct. In 
ZPP, every answer is certain, but the algorithm is only prob¬ 
ably fast. Meanwhile BQP is quantum polynomial time; this 
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part of Theorem 1.2 just follows from the fact that Shor’s al¬ 
gorithm can compute discrete logarithms and factor integers 
[ 21 ]. 

To the author’s knowledge, Theorem 1.2 yields the first 
competitive quantum algorithm for any natural question in 
3-manifold topology. For comparison, Aharonov, Jones, and 
Landau [2] give an algorithm to approximate the Jones poly¬ 
nomial of a knot at a principal root of unity; this algorithm 
also has a version for 3-manifolds [7]. However, the approx¬ 
imation is usually exponentially poor; any fair approximation 
that could be useful for geometric topology is #P-hard [12]. 

This raises the following question: Are quantum computers 
good at 3-manifold topology more broadly; or do they only 
understand lens spaces especially well? It is also possible that 
quantum computers do not even understand lens spaces espe¬ 
cially well, if there is a fast classical algorithm to compute 
k. Note that our algorithm generalizes to distinguish higher¬ 
dimensional lens spaces, as explained in the remark at the end 
of Section 4.2. In this case, a well-known result of Novikov 
[15] implies that there is no recursive algorithm at all to dis¬ 
tinguish lens spaces from other manifolds in dimension d>5. 

Finally, we note one more corollary of the proof of Theo¬ 
rem 1.1: an upper bound on the work to calculate k without 
any help. 

Corollary 1.3. If M is a closed 3-manifold given by a trian¬ 
gulation with t tetrahedra where secretly M = L{n,k). Then k 
can be calculated in heuristic time 

^agO((logn)F3(ioglogn)2/^) 


BQP 



ZPP 


P 


Figure 1. Inclusions of some decision complexity classes. 


2. COMPLEXITY CLASSES 

We briefly review some relevant complexity classes; see the 
Complexity Zoo [23] for more information. 

If E is a finite alphabet, then E* denotes the set of all finite 
strings over E, interpreted as data strings. A decision problem 
is a function 

D-.lf ^ {yes,no}, 
while a function problem is a function 

f-.r^r. 


Corollary 1.3 simply states the running time of the num¬ 
ber field sieve algorithm [8] applied to the discrete logarithm 
problem over Z/.f. Since the work estimate is dominated by 
the value of n, not f. Corollary 1.3 seems strong in the range 

(logn)*/^ > logf > log log «. 

A more precise work estimate follows from the heuristic pre¬ 
diction of Wagstaff and McCurley [ 14] that we can take 


A complexity class is a set of decision problems or function 
problems, generally those problems that can be computed 
with certain resources. It is more standard to start with de¬ 
cision problems, some which are asymmetric between “yes” 
and “no”. Such a class has a dual class defined by switch¬ 
ing “yes” and “no” and denoted with a co prefix; for instance 
coNP. We are interested in the following decision classes, 
which are listed together with the type of algorithm that is al¬ 
lowed to compute an algorithm in each of them. 


£= (2-Po(l))0(n)(log«)^, (1) 

rather than just £ = 0{n) as provided by Linnik’s theorem. 
(Here and in the rest of the article, we use natural logarithm, 
logx = Inx, when the base of the logarithm matters.) 
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• P - A deterministic algorithm that runs in polynomial 
time. 

• BPP - A polynomial-time randomized algorithm 
whose answer is probably correct. 

• BQP - A polynomial-time quantum algorithm whose 
answer is probably correct. 

• N P - A polynomial-time, deterministic verifier with an 
omniscient prover who tries to convince the verifier that 
the answer is “yes”. 

• RP - A randomized, polynomial-time prover-verifier 
whose answer is either a definite “yes” or a probable 
“no”. Equivalently, the subclass of NP in which a proof 
certificate can be chosen at random. 
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• ZPP - A randomized prover-verifier whose answer is 
certain and who probably succeeds in polynomial time. 
Equivalently, RPficoRP. 

These classes nest as shown in Figure 1. It is conjectured that 
P = BPP BQP 2 NP coNP, 
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while the remaining relation BQP C NP has no clear evidence 
for either answer. 

Remark. In the standard definition of the probabilistic classes 
BPP, BQP, RP, and ZPP, the probabilities are bounded away 
from failure by constants. An algorithm in BPP gives the cor¬ 
rect answer with probability at least 2/3; an algorithm in ZPP 
finishes quickly with probability at least 1 /2; etc. By using 
repeated trials, the probabilities can be amplified to be expo¬ 
nentially close to 1. This fact, combined with constructions of 
cryptographic psuedorandom number generators, is taken as 
evidence that P = BPP. 

Some decision complexity classes have standard functional 
counterparts. One convention is to add an F prefix; for in¬ 
stance, FNP. One can also just say “functional NP” or “func¬ 
tional BQP”. 

3. HARD LENS SPACES 

In this section, we will construct lens spaces M = L{n,k) 
where n is much larger than the number of tetrahedra f, and 
k is unpredictable. According to Theorem 1.2, identifying M 
is easy if n is a smooth number (meaning that it has no large 
prime factors). We cannot prove that our construction can pro¬ 
duce values of n with large prime factors, but computer ex¬ 
periments suggests that it can. Also, the specific triangulated 
manifolds that we construct are easy to identify. However, 
they can then be obfuscated with a sequence of local moves 
on triangulations {e.g., Newman-Pacher bistellar moves). Our 
conclusion is that there are many triangulations of lens spaces 
that seem difficult to identify. 

Proposition 3.1. There exists a family of triangulated lens 
spaces {M = L{ri,k)} with t = t(n,k) tetrahedra, such that n 
is exponential in t and there are exponentially many choices 
for kfor each fixed n. 

Proof Our construction is equivalent to a well-known con¬ 
struction of lens spaces using Dehn surgery on a chain of un¬ 
knots [18, Ex. 9H13]. 

We choose a fixed triangulation a of the torus T = x 
5'*, and we choose two solid tori Xi,X 2 with dX\,dX 2 = T, 
and with triangulations ai, O 2 that extend a. We can describe 
an element of the mapping class group of T by an element 
of GL(2,Z) that describe its action on the homology group 
H\{T). For each 1 < a < 5, we choose a fixed triangulation 
Xa of a torus bundle over an interval, T x I, that connects the 
triangulation (7 of T to itself using the monodromy matrix 



Our construction is to concatenate a sequence {Xaj}i<j<m of 
these mapping cylinders together with a solid torus at each 
end, as in Figure 2. We also assume that ui > 1. The tetra¬ 
hedron number t is thus Oijn). If the solid tori ffi and <72 are 
positioned suitably, then the result is M = L{n,k), where n and 
k are given as a finite continued fraction; 

n 1 


If we let nj/kj be the /th partial evaluation, then we can also 
express the calculation with the recurrence 

kj = nj = ajiij^i + kj = ajnj^i + «;-2- 

The answer n/k determines the monodromy numbers {aj} 
since the continued fraction is unique under the constraint 
<21 > 1. Since the integers {nj} increase, we obtain the in¬ 
equality 

nj < {aj + 

If we choose the sequence of monodromy numbers at random, 
we obtain the probabilistic relation 

Ex[log«j] < Ex[log(a; -F 1)] -F Ex[logn;]. 

Also, 

Ex[log(„, + 1)] = (I°8^) + (I°83H- + (I°SC) 

< log3.73. 

By the law of large numbers, most monodromy sequences 
produce n < 3.73'". On the other hand, there are 4 • 5'"^* se¬ 
quences of length m, so by the pigeonhole principle, some 
value of n must see exponentially many values of k. Any such 
value of n must also be exponentially large. In any case, for 
every choice of numbers {aj}, {iij} grows at least as fast as 
the Fibonacci numbers, which also implies that n is exponen¬ 
tially large. □ 

4. ALGORITHM AND PROOFS 
4.1. Reidemeister torsion 

We review Reidemeister torsion [22] from the algorithmic 
point of view. 

Suppose that 

C* = {Ck - Ck-\}G<k<m 

is a finite, acyclic chain complex over a field F. (Reidemeister 
torsion is well defined for a free complex over any commuta¬ 
tive ring, but it is easier to discuss algorithms in the field case.) 
Suppose in addition that each term Q has a distinguished ba¬ 
sis. Since C* is acyclic and finite, it is isomorphic to a direct 
sum of complexes of the form 

0 —>F —^0. 





4 



Figure 2. A lens space L(n,k) as solid tori with triangulations (7i and 02. connected by twisted bundles (5^ x 5*) x / with triangulations Xaj- 


Define an adapted basis A* for C* to be one induced by such 
a decomposition. In other words, if € A^t is a basis vector, 
then either da^ = 0, ot: da^ & Ai._i is another basis vector. 
Then the Reidemeister torsion of C* is 

A(C*) (detAo)(detAi)^^(detA 2 ) • • • (detAm)*^, 

where each A, is also interpreted as the change-of-basis ma¬ 
trix from the distinguished basis to the adapted basis. The 
following two facts are standard; 

1. Every adapted basis yields the same value of A(C*). 

2. Let C* be the chain complex of a finite CW complex <7 with 

PL attaching maps, possibly with twisted coefficients, 
and using the cells of <7 as its distinguished basis. Then 
the Reidemeister torsion A(C*) is invariant under refine¬ 
ment of (7. 

The second fact essentially says that Reidemeister torsion is a 
PL topological invariant. We just have to be careful because 
the sign of A(C*) depends on the ordering and orientation of 
the cells of (7, and ambiguities in the local coefficient system 
can also make A(C*) multivalued. 

Given C* as input, we can find an internal basis by induc¬ 
tion working from either end, while determinants can be cal¬ 
culated in polynomial time by row reduction. In conclusion, 
the Reidemeister torsion A(C*) can be calculated in a polyno¬ 
mial number of arithmetic operations in the field F. 

Let M be a closed, oriented rational homology 3-sphere 
with a triangulation. We first calculate its untwisted Reide¬ 
meister torsion with coefficients in L = Q. Using the orienta¬ 
tion, we can canonically augment the chain complex C* (M; Q) 
at both ends to obtain the acyclic complex 

0—>Q^C3(M;Q)^C2(M;Q) I 

^Ci(M;Q)^Co(M;Q)^Q^Oj ■ 

Then it is standard that 

A(e*)=±|//i(M;Z)|. 

The sign is not a topological invariant, because the y'-simplices 
of M are unordered and unoriented, so they only provide 
Cj{M\<Q) with an unordered, unsigned basis. We choose 
an ordering and an orientation of the simplices such that 
A(e*)>o. We can then use the same ordering and orientation 


an other Reidemeister torsion calculation on M with twisted 
coefficients. 

Suppose further that 

Hi{M) = ^Z/n. 

Then we can compute n in P by computing the Smith nor¬ 
mal form of the differential of the simplicial chain complex 
C*(M). Thus, as mentioned in Section 1, « is no secret. We 
also want an explicit simplicial 1 -cocycle (0 such that [at] gen¬ 
erates //* (M;Z/«); this too can be calculated in P. 

Linally suppose that M = L{n,k) is a lens space, and let 
F = Q{Q, where 7 ^ 1 is a formal root of unity whose order 
m divides n. We can use the cocycle CO to define a twisted 
coefficient system Q{Q^oi on M, and let 

R* =C*(M;Q(C)5®). 

Then a calculation shows that 

A(R*) = r(l-C“)(l-C''), ( 2 ) 

where 

- = G Zjm. 
b 

This answer is easy to calculate using the standard cellulation 
of L{n,k) with one cell in each dimension, as follows. Lor 
a convenient choice of twisted coefficients, this CW complex 
yields 

0 ^ Q(C) ^ Q(C) A Q(C) Q(C) ^ 0. 

Thus, 

A(R*) = (1-C)(1-C^). 

The formula (2) is the same as this one, except generalized to 
allow unavoidable ambiguities. The factor of 1 ^^ arises when 
we change the choice of co. Other than their ratio, a and b are 
ambiguous as well, as follows. Lirst, the value of the torsion 
( 2 ) does not determine the global sign of a and b, only their 
relative sign, since 

C^(i - C")(i - C*) = - C^“)(i - C^*)- 
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The formula is also symmetric in a and b, so we cannot dis¬ 
tinguish k from 1 /k. This stands to reason, since 

L{n,k) = L{n, 1 /k). 

Second, if we replace (0^-^xco for some x € (Zjn)^, then this 
has the same effect as i—?> which then multiplies a, b, and 
c by ;r. 

As mentioned in Section 1, if « = m and n is exponential in 
the size of the triangulation of M, then the direct calculation of 
(2) is not in P because of the field is high-dimensional 
over Q. 

4.2. Number theory 

Recall that 

(j){n) = \(Z/n)^\ 
is the Euler phi function. 

We seek a prime number ^= \ (mod u). Dirichlet’s theo¬ 
rem says that there are infinitely many such primes and that 
they eventually have density 1/0 (n) among all primes. We 
need an effective version of this theorem, a result which was 
first obtained by Linnik. 

Theorem 4.1 (Linnik [10, Ch. 18]). If a^b > 0 are coprime 
integers, let 7t{x;a,b) be the number of prime numbers i <x 
such that £ = b (mod a). There is a universal constant L such 
that ifx > a^, then 

^{a)7t{x;a,b) ^ 
x/(logx) “ ■ 


Suppose that satisfies = 1 and f 1. Then 

we can follow the calculation in Section 4.1, using Zjl rather 
than Q(C)- We can construct the twisted coefficient system 
(Z/^)^(i). Copying (2), the answer is still 

/(C) =/-(C) = A(C*(M;(Z/^)j«)) = C‘^(l - C^)(l - C"). 

However, this value f(ff) can be computed in P once we know 
i and 1 ^. We now calculate 

/+(C) = J^ = C^(1 + C'“)(1 + C'') 

■/— (0 _-j- 

^ ^,^def /+(C)-/-(C) _ 
def ^+(0 ^+(C ) _ 

Thus, using the three evaluations /(C), /(C^), /(C^), 

we can learn the sum g+(C) and the product h{l^) of and 
^ra+fo+c. g-(C) and the product h{Q of and 

\Ye can thus solve quadratic equations in Z/£ for all 
four of these numbers. We can then learn the values of an 
unordered pair {C“', C'*}, with i = ±1, by taking ratios. 

If n < 4, then we can directly calculate the Reidemeister 
torsion of M; so suppose that « > 4. If C has order n, then 
we can use discrete logarithm to obtain the unordered pair 
then take their ratio in Z/n to obtain k*/ To find 
a suitable C, we choose a £ (Z/£)^ at random and then let 

C = a/-iV/ (3) 


Less formally: The usual prime number theorem says that 
the probability that a randomly chosen £ < x is prime is sa 
1 /(logx). Heuristically, we expect these primes to be equally 
distributed among all 0(fl) prime congruence classes modulo 
a. Dirichlet’s theorem says that this heuristic is correct, while 
Linnik’s theorem establishes a constant L such that the heuris¬ 
tic becomes true when x > a^. 


If we have discrete logarithm, then we also have factoring, 

9 

so we can factor n and use the test = 1 for each maximal 
divisor m\n to determine whether has order n in . 

When n> 12, it has order n with probability 


Pr[ord(Q = n] 


0 («) ^ 1 
n TTloglogn 


Remark. Lest the unspecified constant L seem discouraging, 
the Wagstaff-McCurley conjecture (1) implies that it is fast 
enough to test consecutive values of ^ = 1 (mod n) starting 
with p+\. Computer experiments also suggest that if we ran¬ 
domly choose £ = \ (mod n) in the range then the 

probability that £ is prime is always at least l/(41ogn) for 
each n > 2. 


(This follows from [19, Thm. 15] when n > 67.) So we can 
find an «th root of unity I with adequate probability, 

and then compute k’*"' from/(i^),/(i^^), and/(i^"^). □ 

Remark. The calculation in the proof of Theorem 1.1 is much 
less special than it may seem. Suppose that we can evaluate a 
linear combination 


Proof of Theorem 1.1. If we randomly choose an £ = 1 
(mod n) with only linearly more digits than n itself, then it 
is prime with adequate probability. We need to check whether 
a candidate £ is prime. It is now known that primality is in 
P [1]; an algorithm in ZPP was found previously [3]. Thus, 
finding £ is in ZPP. Actually, we do not even need to i to be 
prime, we only need «th roots of unity in Z/£. If the factor¬ 
ization of n is known, then we can find such an £ with much 
simpler methods. 


/(C)=ciC“‘+c2r+---+c,„r" 

for various roots of unity = 1, with known coefficients but 
unknown exponents. Then any m of these evaluations, e.g., 
/(CO fori yield a system of m polynomial equations 

with m unknowns. It turns out that any system of polynomial 
equations over Z/f of fixed size can be solved in ZPP [5, 
6]. As a corollary, we can use the same algorithm to identify 
higher-dimensional lens spaces. 
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Proof of Theorem 1.2. As mentioned in Section 1, integer fac¬ 
torization and discrete logarithm are both in BQP by Shor’s 
algorithm. Thus, calculating k is immediately in BQP as well. 
For the FNP result, the prover can provide these data values; 

1. The value of k. 

2. A prime l= \ (mod n). 

3. An nth root of unity £ Z/£. 

4. The prime factorization of n. 

Using this certificate, a deterministic verifier can confirm that 
has order n, and then follow the calculation in the proof if 
Theorem 1.1 to calculate (Even though k is ambiguous, 
the prover will known whether it is to be k or since the 
verifier is entirely predictable.) The verifier also has to know 
to trust the prime factorization of n. For this purpose we can 
again use that primality is in P, or in ZPP C NP; there is also 
a much simpler earlier construction that primality is in N P due 
to Pratt [16]. 

If the verifier only sees the value of k, then we can still 
search for £ at random, test its primality, and then choose 
a £ {Tjjiy^ at random and exponentiate it to obtain as in 
(3). If = 1, then we reject it and choose another value of a. 


Otherwise it has order m\ii, with m = n with adequate proba¬ 
bility. In this case, we can learn the unordered pair {C™, 

and calculate the test possibly with a and b 

switched, and as before with s = ±1. This gives us the value 
k** £ Z/m. Since m = n with adequate probability, and or 
otherwise since n could be the 1cm of several values of m, this 
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shows that M = L{n,k) is in coRP when k is part of the input. 

Finally, if n is polynomially smooth, then it can be fac¬ 
tored in polynomial time; a randomly chosen can be con¬ 
firmed; and there is a simple algorithm to compute discrete 
logarithms, as follows. Suppose that we know x = and 
that we know a small factor m\n (not necessarily prime). By 
induction, we first solve the equation to learn 

a £ 1l{nlm)-, more explicitly, we learn 

, nb 

a = a-\ - 

m 

with unknown b £ Z/m. We can then solve the equation 

X^-P — 

for b by exhaustive search. In this version of the algorithm, 
only finding i and ^ requires ZPP; the rest is in P. □ 
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